![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 53%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELC%3C/text%3E%3C/svg%3E)
Artifact Signing
A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)
Pin the Artifact Signing client to AzureCliCredential for one final controlled test; acquiring a valid token with Azure CLI does not establish that DefaultAzureCredential selected that same identity when the dlib submitted the digest.
Run a credential-isolated signing test
Artifact Signing’s dlib uses DefaultAzureCredential, which tries multiple credential providers in sequence. Microsoft documents that unwanted providers can be disabled individually, and a closely matching Submitting digest for signing 403 was resolved by excluding the other providers.^1^^2^
- Sign out of Azure CLI, then authenticate as the intended test principal in the correct tenant and subscription.
- Modify a copy of
metadata.jsonso that onlyAzureCliCredentialremains available:
{
"Endpoint": "https://eus.codesigning.azure.net",
"CodeSigningAccountName": "<artifact-signing-account-name>",
"CertificateProfileName": "<certificate-profile-name>",
"CorrelationId": "PCDI-Build6-v3-AzureCliOnly",
"ExcludeCredentials": [
"EnvironmentCredential",
"WorkloadIdentityCredential",
"ManagedIdentityCredential",
"SharedTokenCacheCredential",
"VisualStudioCredential",
"VisualStudioCodeCredential",
"AzurePowerShellCredential",
"AzureDeveloperCliCredential",
"InteractiveBrowserCredential"
]
}
- Run the existing x64 SignTool command against an unsigned copy of the executable with
/v /debug. - Record the exact UTC start time and retain the complete console output.
Do not exclude AzureCliCredential in this test. Also verify that CodeSigningAccountName is the Artifact Signing resource name—not an email address, application name, or Entra identity—and that CertificateProfileName is the exact profile resource name. Those fields and the regional endpoint are the identifiers sent by the signing integration.^1^
If this succeeds, the previous attempts were authenticating through another provider in the DefaultAzureCredential chain. Keep the exclusions appropriate to the credential used by the production process.
If the isolated test still returns 403
Backend investigation is warranted. Your tests already cover nearly all officially documented 403 checks: endpoint, signer role, account/profile names, runtime and toolchain, completed identity validation, active profile, endpoint reachability, and an alternate network.^3^
The certificate profile is the resource that both generates signing certificates and receives the signing-role authorization; it must align with a completed identity validation of the same trust model.^4^ A persistent failure across two principals after credential isolation cannot be diagnosed conclusively from the client-side 403 alone.
Request that Microsoft check:
- Whether each correlation ID reached the Artifact Signing data plane.
- The server-side authorization decision and reason code for
StartSignAsync. - Account and certificate-profile provisioning/eligibility state.
- The profile’s effective association with the intended completed Public Trust identity validation.
- Whether the currently active short-lived certificate is enabled for data-plane signing.
- Any compliance, policy, billing, or subscription-state gate not exposed by the control plane.
- Whether a regional service incident affected East US at the supplied UTC times.
Escalation package
From the Artifact Signing account in Azure portal, open Support + Troubleshooting. If offered, continue through Create a support request or the Priority Community Support/Q&A route. Technical support normally depends on the support plan, but the portal determines the available route.^5^
Include privately:
- Subscription, tenant, account, profile, identity-validation, and resource IDs.
- Both principal object IDs and the RBAC scope.
- Exact UTC timestamps and unique correlation IDs.
- Full verbose/debug SignTool output.
-
metadata.jsonwith names retained but secrets removed. - SignTool, dlib, .NET, Azure CLI, and OS versions.
- Dlib and unsigned executable SHA-256 hashes.
- Screenshot/export showing profile
Active, validationCompleted, and certificate status. - Confirmation that the Azure-CLI-only test still failed.
Retain the exact unsigned file and its hash; Microsoft specifically recommends preserving the file/hash and optionally subscribing to signing transaction events for troubleshooting.^3^
Do not publish tenant IDs, subscription IDs, object IDs, or logs containing tokens. A Microsoft moderator can initiate a private Q&A conversation, where subscription/tenant IDs and scrubbed traces are permitted; only Microsoft moderators—not ordinary users—can send that private message.^6^
References